The only way we could get it to work was to install the Windows Certificate Server web server on our certificate authority.  Each user on a Mac would have to run the certificate wizard in the keychain to create a certificate request and then submit it through the Windows certificate server.   It's not ideal, but it works.   Also, just a heads up that using MacOS certificates and AnyConnect is broken on 17.10.2.  We are working with support and are stuck on 16.16.3 right now. ... View more